Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-61884

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

7.5
CVSS 3.1
2
stories
OCT 20
added to KEV
Severity
7.5 High · vendor score
Vendor
Oracle
Product
E-Business Suite
Published
Oct 12, 2025
Added to KEV
Oct 20, 2025
KEV deadline
Nov 10, 2025
Ransomware use
Known
Weakness
CWE-22, CWE-93, CWE-287, CWE-444, CWE-501, CWE-918
Part of Oracle E-Business Suite Clop Attacks →

What it is

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. VulnerabilitiesOracle Warns of E-Business Suite BugA Saturday advisory from Oracle’s CISO warned of a vulnerability impacting some deployments of E-Business Suite (CVE-2025-61884).LINDSEY O'DONNELL-WELCH · 1 MIN
  2. VulnerabilitiesOracle Zero-Day Linked to Latest ShinyHunters Attacks“Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day,” said Mandiant researchers.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryoracle.com/security-alerts/alert-cve-2025-61884.htmlVendor advisoryblogs.oracle.com/security/post/apply-july-2025-cpuExploitlabs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882